The purpose of this Communiqué is to set the procedures and principles for the management of the information systems that payment institutions and electronic money institutions use in carrying out their activities under the Law, and for their audit by authorized independent audit firms.
This Communiqué was issued on the basis of Articles 14, 18 and 21 of the Law and Article 64 of the Regulation.
The details of the Communiqué can be found at the link below:
https://www.mevzuat.gov.tr/mevzuat?MevzuatNo=19817&MevzuatTur=9&MevzuatTertip=5
Preparing for the audit
The areas reviewed in an independent audit are usually: information security management, access and authorization controls, network security, backup and disaster recovery, change management and incident management.
Before the audit, institutions should keep their policies and procedures up to date and prepare their test records (for example, penetration tests and disaster recovery drills).
Preparing a corrective action plan for findings also builds confidence in the audits of later periods.
